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ICO consultation on the draft updated data 
sharing code of practice 


Does the updated code adequately explain and advise on the new aspects of 
data protection legislation which are relevant to data sharing? 


O Yes 
© No 


If not, please specify where improvements could be made. 


We appreciate this code is not just for data protection specialists/experts, but we consider 
that it is still too general in scope and some important aspects/details are missing. We 
believe that the code does not cover at all or in any useful detail: - lawful basis in Art6(1)(e) 
public task - when it’s available to private organisations for data sharing & definitions/ 
examples of ‘public task’; - the distinction between public and private sectors and issues 
with data transfers between them (only briefly mentioned on pp64-65); in particular:- * 
guidance on how to reconcile data subject rights when their data has been processed under 
Part 2 and shared with a competent authority processing under Part 3 would be helpful; * 
does not really cover the sharing of information from a competent authority to an 
organisation (p 64 briefly mentions the sharing of information between an organisation and a 
competent authority); * your exemptions guidance in the Guide to GDPR states that 
exemptions should not be routinely relied upon but should be applied on a case by case 
basis; what implication does this have on routine data sharing? * Guidance on the use of 
exemptions in data sharing would be helpful; * does not really cover criminal offence data 
processing (and intel) by private organisations under Part 2 DPA * no mention of 
safeguarding, especially by private organisations; and * there is no guidance on what would 
constitute suitable “arrangements” as between joint controllers, pursuant to Article 26. 
These points should be added/clarified. And more examples from various sectors would be 
helpful. 


Does the draft code cover the right issues about data sharing? 


O Yes 
© No 


Q4 


Q5 


Q6 


Q7 


If no, what other issues would you like to be covered in it? 
As above in response to question 2. 


Does the draft code contain the right level of detail? 


O Yes 
© No 


If no, in what areas should there be more detail within the draft code? 


We consider that further detail on the sharing of information in an emergency would be helpful; as 
currently drafted, we interpret the code as inferring that the definition of an “emergency” is open to 
interpretation, organisation by organisation, but given that the data might include special category data, 
in the climate of an emergency event, being able to reach to guidance that providers greater clarity and 
guidance on what is and is not acceptable in your view would be appreciated. Worrying about good data 
sharing practice in emergency scenarios will be even harder with so little guidance. Page 81 of the draft 
code could provide more examples about emergency situations, i.e. the current example only refers to 
the emergency services but there are many other organisations and charities who could be presented 
with an emergency situation. Could we have a definition of “emergency” or more examples at the very 
least? It would be helpful to have a broader range of examples throughout. Whilst the examples 
provided help to explain the points being made, they narrowly use the same type of organisations 
(police, health etc), when there are many different types of organisations that will need to rely on the 
Code and have all manner of different types of sharing agreements in place. There is no practical 
guidance on what is expected from an “appropriate policy document” in this draft or elsewhere on the 
ICO website. It would be helpful if some guidance could be provided. General guidance on what the 
ICO would expect to see in terms of demonstrating accountability (apart from Art.30 PAR requirement) 
would be helpful; is it possible to provide examples of what the ICO would consider sufficient / not 
sufficient? We note the guidance highlights the importance of accountability but does not provide a steer 


on what a suitable accountability framework might look like. Often, too much is open to interpretation 
which will raciult in a lack af eancietancw 


Has the draft code sufficiently addressed new areas or developments in data 
protection that are having an impact on your organisation’s data sharing 
practices? 


O Yes 
© No 


Q8 Ifno, please specify what areas are not being addressed, or not being 
addressed in enough detail. 


As noted above, the draft does not sufficiently address the use of exemptions under Schedule 2 of the 
DPA2018._ It would also be helpful to see more information provided in relation to international data 
transfers. We appreciate there is much to be decided here, but it would be useful to have included a 
summary of what the current position is and to have highlighted that there have been/will be some 
developments in the area, so organisations are reminded of the need to keep this area under review. A 
good example here is the Privacy Shield. 


Q9 Does the draft code provide enough clarity on good practice in data sharing? 


© Yes 
© No 


Q10 If no, please indicate the section(s) of the draft code which could be improved, 
and what can be done to make the section(s) clearer. 


Generally so, but we would appreciate more broader examples of good practice as previously stated. 


Q1i1 Does the draft code strike the right balance between recognising the benefits of 
sharing data and the need to protect it? 


O Yes 
© No 


Q12 If no, in what way does the draft code fail to strike this balance? 


We think it strikes the right balance between the benefits of sharing data and the need to 
protect it, but it does not sufficiently highlight to individuals why data sharing is beneficial. 
Whilst we appreciate this code is not primarily directed at data subjects, it would 
nevertheless be helpful if we could point individuals to guidance that highlights the personal 
and organisational benefits to sharing information. 


Q13 Does the draft code cover case studies or data sharing scenarios relevant to 


Q14 


your organisation? 


O Yes 
© No 


Please provide any further comments or suggestions you may have about the 
draft code. 


There are insufficient examples and references to third sector organisations. The draft 
states that individuals must be informed of data sharing, but does not go on to mention any 
of the exemptions from notification available. Exemptions are only briefly mentioned but 
none of them are listed or explained in relation to how they interact with data sharing, there 
are no examples provided and there is no link to further guidance. The code refers to 
“fairness” but does not include a definition or examples. We note the paragraph related to 
children’s data, but the draft does not specifically mention person’s at risk. There is also no 


mention of Brexit; can we assume that a future iteration will be published after the UK has 
left the EU? 


Q15 To what extent do you agree that the draft code is clear and easy to 
understand? 


© Strongly agree 

© Agree 

©) Neither agree nor disagree 
© Disagree 

© Strongly disagree 


Q16 Are you answering as: 


O An individual acting in a private capacity (e.g. someone providing their 
views as a member of the public of the public) 


© An individual acting in a professional capacity 
© On behalf of an organisation 
© Other 


Q17 Please specify 
Q18 Please specify 
Royal Society for the Prevention of Cruelty to Animals (“RSPCA”) 


Q19 Please specify 


Thank you for taking the time to share your views and experience. 


